2 * Test functionality of BPF filters for SO_REUSEPORT. The tests below will use
3 * a BPF program (both classic and extended) to read the first word from an
4 * incoming packet (expected to be in network byte-order), calculate a modulus
5 * of that number, and then dispatch the packet to the Nth socket using the
6 * result. These tests are run for each supported address family and protocol.
7 * Additionally, a few edge cases in the implementation are tested.
12 #include <linux/bpf.h>
13 #include <linux/filter.h>
14 #include <linux/unistd.h>
15 #include <netinet/in.h>
19 #include <sys/epoll.h>
20 #include <sys/types.h>
21 #include <sys/socket.h>
25 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
34 uint16_t send_port_min;
37 static size_t sockaddr_size(void)
39 return sizeof(struct sockaddr_storage);
42 static struct sockaddr *new_any_sockaddr(int family, uint16_t port)
44 struct sockaddr_storage *addr;
45 struct sockaddr_in *addr4;
46 struct sockaddr_in6 *addr6;
48 addr = malloc(sizeof(struct sockaddr_storage));
49 memset(addr, 0, sizeof(struct sockaddr_storage));
53 addr4 = (struct sockaddr_in *)addr;
54 addr4->sin_family = AF_INET;
55 addr4->sin_addr.s_addr = htonl(INADDR_ANY);
56 addr4->sin_port = htons(port);
59 addr6 = (struct sockaddr_in6 *)addr;
60 addr6->sin6_family = AF_INET6;
61 addr6->sin6_addr = in6addr_any;
62 addr6->sin6_port = htons(port);
65 error(1, 0, "Unsupported family %d", family);
67 return (struct sockaddr *)addr;
70 static struct sockaddr *new_loopback_sockaddr(int family, uint16_t port)
72 struct sockaddr *addr = new_any_sockaddr(family, port);
73 struct sockaddr_in *addr4;
74 struct sockaddr_in6 *addr6;
78 addr4 = (struct sockaddr_in *)addr;
79 addr4->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
82 addr6 = (struct sockaddr_in6 *)addr;
83 addr6->sin6_addr = in6addr_loopback;
86 error(1, 0, "Unsupported family %d", family);
91 static void attach_ebpf(int fd, uint16_t mod)
93 static char bpf_log_buf[65536];
94 static const char bpf_license[] = "GPL";
97 const struct bpf_insn prog[] = {
98 /* BPF_MOV64_REG(BPF_REG_6, BPF_REG_1) */
99 { BPF_ALU64 | BPF_MOV | BPF_X, BPF_REG_6, BPF_REG_1, 0, 0 },
100 /* BPF_LD_ABS(BPF_W, 0) R0 = (uint32_t)skb[0] */
101 { BPF_LD | BPF_ABS | BPF_W, 0, 0, 0, 0 },
102 /* BPF_ALU64_IMM(BPF_MOD, BPF_REG_0, mod) */
103 { BPF_ALU64 | BPF_MOD | BPF_K, BPF_REG_0, 0, 0, mod },
104 /* BPF_EXIT_INSN() */
105 { BPF_JMP | BPF_EXIT, 0, 0, 0, 0 }
109 memset(&attr, 0, sizeof(attr));
110 attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
111 attr.insn_cnt = ARRAY_SIZE(prog);
112 attr.insns = (uint64_t)prog;
113 attr.license = (uint64_t)bpf_license;
114 attr.log_buf = (uint64_t)bpf_log_buf;
115 attr.log_size = sizeof(bpf_log_buf);
117 attr.kern_version = 0;
119 bpf_fd = syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr));
121 error(1, errno, "ebpf error. log:\n%s\n", bpf_log_buf);
123 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF, &bpf_fd,
125 error(1, errno, "failed to set SO_ATTACH_REUSEPORT_EBPF");
130 static void attach_cbpf(int fd, uint16_t mod)
132 struct sock_filter code[] = {
133 /* A = (uint32_t)skb[0] */
134 { BPF_LD | BPF_W | BPF_ABS, 0, 0, 0 },
136 { BPF_ALU | BPF_MOD, 0, 0, mod },
138 { BPF_RET | BPF_A, 0, 0, 0 },
140 struct sock_fprog p = {
141 .len = ARRAY_SIZE(code),
145 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_CBPF, &p, sizeof(p)))
146 error(1, errno, "failed to set SO_ATTACH_REUSEPORT_CBPF");
149 static void build_recv_group(const struct test_params p, int fd[], uint16_t mod,
150 void (*attach_bpf)(int, uint16_t))
152 struct sockaddr * const addr =
153 new_any_sockaddr(p.recv_family, p.recv_port);
156 for (i = 0; i < p.recv_socks; ++i) {
157 fd[i] = socket(p.recv_family, p.protocol, 0);
159 error(1, errno, "failed to create recv %d", i);
162 if (setsockopt(fd[i], SOL_SOCKET, SO_REUSEPORT, &opt,
164 error(1, errno, "failed to set SO_REUSEPORT on %d", i);
167 attach_bpf(fd[i], mod);
169 if (bind(fd[i], addr, sockaddr_size()))
170 error(1, errno, "failed to bind recv socket %d", i);
172 if (p.protocol == SOCK_STREAM)
173 if (listen(fd[i], p.recv_socks * 10))
174 error(1, errno, "failed to listen on socket");
179 static void send_from(struct test_params p, uint16_t sport, char *buf,
182 struct sockaddr * const saddr = new_any_sockaddr(p.send_family, sport);
183 struct sockaddr * const daddr =
184 new_loopback_sockaddr(p.send_family, p.recv_port);
185 const int fd = socket(p.send_family, p.protocol, 0);
188 error(1, errno, "failed to create send socket");
190 if (bind(fd, saddr, sockaddr_size()))
191 error(1, errno, "failed to bind send socket");
192 if (connect(fd, daddr, sockaddr_size()))
193 error(1, errno, "failed to connect");
195 if (send(fd, buf, len, 0) < 0)
196 error(1, errno, "failed to send message");
203 static void test_recv_order(const struct test_params p, int fd[], int mod)
205 char recv_buf[8], send_buf[8];
207 struct iovec recv_io = { recv_buf, 8 };
208 struct epoll_event ev;
209 int epfd, conn, i, sport, expected;
210 uint32_t data, ndata;
212 epfd = epoll_create(1);
214 error(1, errno, "failed to create epoll");
215 for (i = 0; i < p.recv_socks; ++i) {
218 if (epoll_ctl(epfd, EPOLL_CTL_ADD, fd[i], &ev))
219 error(1, errno, "failed to register sock %d epoll", i);
222 memset(&msg, 0, sizeof(msg));
223 msg.msg_iov = &recv_io;
226 for (data = 0; data < p.recv_socks * 2; ++data) {
227 sport = p.send_port_min + data;
229 memcpy(send_buf, &ndata, sizeof(ndata));
230 send_from(p, sport, send_buf, sizeof(ndata));
232 i = epoll_wait(epfd, &ev, 1, -1);
234 error(1, errno, "epoll wait failed");
236 if (p.protocol == SOCK_STREAM) {
237 conn = accept(ev.data.fd, NULL, NULL);
239 error(1, errno, "error accepting");
240 i = recvmsg(conn, &msg, 0);
243 i = recvmsg(ev.data.fd, &msg, 0);
246 error(1, errno, "recvmsg error");
247 if (i != sizeof(ndata))
248 error(1, 0, "expected size %zd got %d",
251 for (i = 0; i < p.recv_socks; ++i)
252 if (ev.data.fd == fd[i])
254 memcpy(&ndata, recv_buf, sizeof(ndata));
255 fprintf(stderr, "Socket %d: %d\n", i, ntohl(ndata));
257 expected = (sport % mod);
259 error(1, 0, "expected socket %d", expected);
263 static void test_reuseport_ebpf(const struct test_params p)
265 int i, fd[p.recv_socks];
267 fprintf(stderr, "Testing EBPF mod %zd...\n", p.recv_socks);
268 build_recv_group(p, fd, p.recv_socks, attach_ebpf);
269 test_recv_order(p, fd, p.recv_socks);
271 fprintf(stderr, "Reprograming, testing mod %zd...\n", p.recv_socks / 2);
272 attach_ebpf(fd[0], p.recv_socks / 2);
273 test_recv_order(p, fd, p.recv_socks / 2);
275 for (i = 0; i < p.recv_socks; ++i)
279 static void test_reuseport_cbpf(const struct test_params p)
281 int i, fd[p.recv_socks];
283 fprintf(stderr, "Testing CBPF mod %zd...\n", p.recv_socks);
284 build_recv_group(p, fd, p.recv_socks, attach_cbpf);
285 test_recv_order(p, fd, p.recv_socks);
287 fprintf(stderr, "Reprograming, testing mod %zd...\n", p.recv_socks / 2);
288 attach_cbpf(fd[0], p.recv_socks / 2);
289 test_recv_order(p, fd, p.recv_socks / 2);
291 for (i = 0; i < p.recv_socks; ++i)
295 static void test_extra_filter(const struct test_params p)
297 struct sockaddr * const addr =
298 new_any_sockaddr(p.recv_family, p.recv_port);
301 fprintf(stderr, "Testing too many filters...\n");
302 fd1 = socket(p.recv_family, p.protocol, 0);
304 error(1, errno, "failed to create socket 1");
305 fd2 = socket(p.recv_family, p.protocol, 0);
307 error(1, errno, "failed to create socket 2");
310 if (setsockopt(fd1, SOL_SOCKET, SO_REUSEPORT, &opt, sizeof(opt)))
311 error(1, errno, "failed to set SO_REUSEPORT on socket 1");
312 if (setsockopt(fd2, SOL_SOCKET, SO_REUSEPORT, &opt, sizeof(opt)))
313 error(1, errno, "failed to set SO_REUSEPORT on socket 2");
315 attach_ebpf(fd1, 10);
316 attach_ebpf(fd2, 10);
318 if (bind(fd1, addr, sockaddr_size()))
319 error(1, errno, "failed to bind recv socket 1");
321 if (!bind(fd2, addr, sockaddr_size()) && errno != EADDRINUSE)
322 error(1, errno, "bind socket 2 should fail with EADDRINUSE");
327 static void test_filter_no_reuseport(const struct test_params p)
329 struct sockaddr * const addr =
330 new_any_sockaddr(p.recv_family, p.recv_port);
331 const char bpf_license[] = "GPL";
332 struct bpf_insn ecode[] = {
333 { BPF_ALU64 | BPF_MOV | BPF_K, BPF_REG_0, 0, 0, 10 },
334 { BPF_JMP | BPF_EXIT, 0, 0, 0, 0 }
336 struct sock_filter ccode[] = {{ BPF_RET | BPF_A, 0, 0, 0 }};
337 union bpf_attr eprog;
338 struct sock_fprog cprog;
341 fprintf(stderr, "Testing filters on non-SO_REUSEPORT socket...\n");
343 memset(&eprog, 0, sizeof(eprog));
344 eprog.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
345 eprog.insn_cnt = ARRAY_SIZE(ecode);
346 eprog.insns = (uint64_t)ecode;
347 eprog.license = (uint64_t)bpf_license;
348 eprog.kern_version = 0;
350 memset(&cprog, 0, sizeof(cprog));
351 cprog.len = ARRAY_SIZE(ccode);
352 cprog.filter = ccode;
355 bpf_fd = syscall(__NR_bpf, BPF_PROG_LOAD, &eprog, sizeof(eprog));
357 error(1, errno, "ebpf error");
358 fd = socket(p.recv_family, p.protocol, 0);
360 error(1, errno, "failed to create socket 1");
362 if (bind(fd, addr, sockaddr_size()))
363 error(1, errno, "failed to bind recv socket 1");
366 if (!setsockopt(fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_EBPF, &bpf_fd,
367 sizeof(bpf_fd)) || errno != EINVAL)
368 error(1, errno, "setsockopt should have returned EINVAL");
371 if (!setsockopt(fd, SOL_SOCKET, SO_ATTACH_REUSEPORT_CBPF, &cprog,
372 sizeof(cprog)) || errno != EINVAL)
373 error(1, errno, "setsockopt should have returned EINVAL");
378 static void test_filter_without_bind(void)
382 fprintf(stderr, "Testing filter add without bind...\n");
383 fd1 = socket(AF_INET, SOCK_DGRAM, 0);
385 error(1, errno, "failed to create socket 1");
386 fd2 = socket(AF_INET, SOCK_DGRAM, 0);
388 error(1, errno, "failed to create socket 2");
390 attach_ebpf(fd1, 10);
391 attach_cbpf(fd2, 10);
400 fprintf(stderr, "---- IPv4 UDP ----\n");
401 /* NOTE: UDP socket lookups traverse a different code path when there
402 * are > 10 sockets in a group. Run the bpf test through both paths.
404 test_reuseport_ebpf((struct test_params) {
405 .recv_family = AF_INET,
406 .send_family = AF_INET,
407 .protocol = SOCK_DGRAM,
410 .send_port_min = 9000});
411 test_reuseport_ebpf((struct test_params) {
412 .recv_family = AF_INET,
413 .send_family = AF_INET,
414 .protocol = SOCK_DGRAM,
417 .send_port_min = 9000});
418 test_reuseport_cbpf((struct test_params) {
419 .recv_family = AF_INET,
420 .send_family = AF_INET,
421 .protocol = SOCK_DGRAM,
424 .send_port_min = 9020});
425 test_reuseport_cbpf((struct test_params) {
426 .recv_family = AF_INET,
427 .send_family = AF_INET,
428 .protocol = SOCK_DGRAM,
431 .send_port_min = 9020});
432 test_extra_filter((struct test_params) {
433 .recv_family = AF_INET,
434 .protocol = SOCK_DGRAM,
436 test_filter_no_reuseport((struct test_params) {
437 .recv_family = AF_INET,
438 .protocol = SOCK_DGRAM,
441 fprintf(stderr, "---- IPv6 UDP ----\n");
442 test_reuseport_ebpf((struct test_params) {
443 .recv_family = AF_INET6,
444 .send_family = AF_INET6,
445 .protocol = SOCK_DGRAM,
448 .send_port_min = 9040});
449 test_reuseport_ebpf((struct test_params) {
450 .recv_family = AF_INET6,
451 .send_family = AF_INET6,
452 .protocol = SOCK_DGRAM,
455 .send_port_min = 9040});
456 test_reuseport_cbpf((struct test_params) {
457 .recv_family = AF_INET6,
458 .send_family = AF_INET6,
459 .protocol = SOCK_DGRAM,
462 .send_port_min = 9060});
463 test_reuseport_cbpf((struct test_params) {
464 .recv_family = AF_INET6,
465 .send_family = AF_INET6,
466 .protocol = SOCK_DGRAM,
469 .send_port_min = 9060});
470 test_extra_filter((struct test_params) {
471 .recv_family = AF_INET6,
472 .protocol = SOCK_DGRAM,
474 test_filter_no_reuseport((struct test_params) {
475 .recv_family = AF_INET6,
476 .protocol = SOCK_DGRAM,
479 fprintf(stderr, "---- IPv6 UDP w/ mapped IPv4 ----\n");
480 test_reuseport_ebpf((struct test_params) {
481 .recv_family = AF_INET6,
482 .send_family = AF_INET,
483 .protocol = SOCK_DGRAM,
486 .send_port_min = 9080});
487 test_reuseport_ebpf((struct test_params) {
488 .recv_family = AF_INET6,
489 .send_family = AF_INET,
490 .protocol = SOCK_DGRAM,
493 .send_port_min = 9080});
494 test_reuseport_cbpf((struct test_params) {
495 .recv_family = AF_INET6,
496 .send_family = AF_INET,
497 .protocol = SOCK_DGRAM,
500 .send_port_min = 9100});
501 test_reuseport_cbpf((struct test_params) {
502 .recv_family = AF_INET6,
503 .send_family = AF_INET,
504 .protocol = SOCK_DGRAM,
507 .send_port_min = 9100});
510 test_filter_without_bind();
512 fprintf(stderr, "SUCCESS\n");